The online publication of the list of candidates admitted to an intermediate stage of a public competition, containing their names, first names, and scores, constitutes an unlawful disclosure of data in the absence of a specific legal basis, even if it results from an operational error.

Facts and context

The Italian data protection authority (GPDP) has today published a sanction decision against the Agency for Digital Italy (AGID), including the imposition of a fine of €15,000, for breaches related to the online publication of personal data of candidates in a public competition.

The case originated from a complaint by a candidate in a competition organized in 2021, who noticed the online publication of the list of participants admitted to the oral exam, including his name, first name, and score.

Reasons for the decision

• Obligation of lawfulness and data minimization (Article 5 of the GDPR and Article 6 of the GDPR): The authority recalls that while public bodies may process data within the framework of competition procedures based on the performance of a task carried out in the public interest, the online disclosure of such data must be based on a specific and proportionate legal basis. However, Italian transparency legislation requires the publication of final competition rankings, but not intermediate lists such as candidates admitted to an exam. By publishing the list of fifteen candidates admitted to the oral exam with their names, first names, and scores, AGID carried out a data disclosure without an adequate legal basis, thus violating the principle of lawfulness. The authority also considers that this publication is contrary to the principle of minimization, as it was not necessary with regard to the purposes of administrative transparency. The fact that this publication was due to a "simple operational error" does not remove the unlawfulness of the processing.

Decision of the authority

Consequently, the authority imposed a fine of €15,000 on the Agency for Digital Italy.

Furthermore, the authority ordered the publication of its decision on its website.

Lessons learned

This decision confirms that:

• The online publication of personal data by a public body must be based on a clear and specific legal obligation, which cannot be inferred from the general authorization to process data for the performance of a task carried out in the public interest.
• In recruitment procedures, only final result lists (final rankings) should be published online; intermediate results (lists of candidates admitted to exams, scores) should be communicated only to the candidates concerned, for example via a secure space.
• An operational error or "simple negligence" does not exempt the data controller from responsibility in the event of unlawful data disclosure, although the non-intentional nature of the breach may be taken into account when determining the amount of the sanction.